This IP is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scam ...
show moreThis IP is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammers by anitahost.com, who are using the ns1.*.serverdns.org nameserver
Here is a list of some of the scam sites that are being hosted here,
These are mostly fake bank scams and fake investment scams, which are both variants of the 419 advanced fee fraud scam
24aitradercity.com
akashxtradingsltd.com
alphabnkuk.com
atloffshore.info
autofxtrademaster.live
blocktradesfxpro.com
capitalassetpoint.com
capitalgrouplimited.ltd
capitalmorisltd.com
capitalwestgrand.com
climaxpromarket.com
credowallet.com
deutsclandtrading.com
grandheritagetrust.com
horizcaptassetincs.com
icwbsonline.info
imperoconsult.com
itsbsonline.info
maincapitaltradeline.com
maximinxassetltd.com
monarchpaybnk.com
monlincapital.com
newwealthbridge.com
nexusglobalwealth.com
noblegatetrust.com
offshorepacific.info
opentradelimited.com
show less
This is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammer ...
show moreThis is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammers
Scam hosters: https://claudpod.com/
5.135.193.195 on the following nameservers:
https://dns.coffee/nameservers/ns5.claudpodserver.com
https://dns.coffee/nameservers/ns6.claudpodserver.com
ISP Server Managed by Hostseo Networks
Usage Type Data Center/Web Hosting/Transit
ASN AS16276
Hostname(s) route-a4.claudpodserver.com
Domain Name hostseo.com
Country 🇫🇷 France
City Strasbourg, Grand Est
fake bank scams:
----------------
monzacapitalsavings.com
horizoneonlineintl.com
aureviatruistbank.com
quantanexarefunds.com
tidetrustbank.org
springfieldcouncil.com
fake investment scams:
----------------------
primeactivetrade.org
markovamarkets.net
investpvf.com
capitalhivetrading.com
show less
This is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammer ...
show moreThis is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammers, they are all ex dns1.geebytesdns.com sites, and likely connected to geebytescloud.com (https://dns.coffee/nameservers/dns1.geebytesdns.com)
They moved 300+ sites on july 5th:
https://dns.coffee/nameservers/ns3.claudpodserver.com
https://dns.coffee/nameservers/ns4.claudpodserver.com
and were being hosted on interserver - 161.129.70.4 before moving to OVH.net where they are currently:
ISP OVH SAS
Usage Type Data Center/Web Hosting/Transit
ASN AS16276
Hostname(s) offshore1.claudpodserver.com
Domain Name ovh.net
Country 🇫🇷 France
City Dunkirk, Hauts-de-France
show less
This IP is being used by afeeshost.com who are a Nigerian 419 advanced fee fraud scam facilitating w ...
show moreThis IP is being used by afeeshost.com who are a Nigerian 419 advanced fee fraud scam facilitating web host, they don't act on abuse reports and actively host scam sites for other Nigerian cyber criminals
Name Servers:
dns1.afeeshost.ltd
dns2.afeeshost.ltd
dns3.afeeshost.com
Here are some of the scam sites:
inteltrustfx.com
maxdropassets.com
noblex-markets.com
show less
This is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammer ...
show moreThis is being used to host 419 advanced fee fraud scam sites for Nigerian advanced fee fraud scammers, they are all ex dns1.geebytesdns.com sites, and likely connected to geebytescloud.com (https://dns.coffee/nameservers/dns1.geebytesdns.com)
just moved 300+ sites on july 5th:
https://dns.coffee/nameservers/ns3.claudpodserver.com
https://dns.coffee/nameservers/ns4.claudpodserver.com
show less
This is connected to lytehosting.com (Who are Nigerian 419 advanced fee fraud scam facilitators on a ...
show moreThis is connected to lytehosting.com (Who are Nigerian 419 advanced fee fraud scam facilitators on a massive scale and ignore all abuse reports) and already has SBL listings on Spamhaus about these IPs:
https://check.spamhaus.org/results/?query=SBL697975
https://check.spamhaus.org/results/?query=SBL697980
SBL697975 - 163.61.188.108
2026-06-03 12:35:16 - newdhaka.net
Spammer Controlled Nameserver: ns1/2.globaldnsnetwork.com
This IP address is currently in use as a nameserver for spamvertized domains. This enables the resolving of spammed domains to the actual websites. This SBL record can only be removed if this IP address stops answering DNS queries for spamvertized domain names.
---
ns1.globaldnsnetwork.com. 270 IN A 163.61.188.108
ns2.globaldnsnetwork.com. 264 IN A 163.61.188.108
We can see all the scam sites on the nameserver listed here: https://dns.coffee/nameservers/ns1.globaldnsnetwork.com
show less
Used by Nigerian 419 advanced fee fraud scammers
Reserve Bank of India <[email protected]> sendi ...
show moreUsed by Nigerian 419 advanced fee fraud scammers
Reserve Bank of India <[email protected]> sending 419 emails from
Return-Path: <[email protected]>
Received: from c4.my-control-panel.com (c4.my-control-panel.com. [198.251.88.188]) by mx.google.com with ESMTPS id ffacd0b85a97d-4606f308fdcsi17190392f8f.287.2026.06.15.06.20.17 for <[email protected]> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Jun 2026 06:20:17 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 198.251.88.188 as permitted sender) client-ip=198.251.88.188;
show less
Just more 419 advanced fee fraud scams being hosted on Ultahost who do nothing about them:
247tra ...
show moreJust more 419 advanced fee fraud scams being hosted on Ultahost who do nothing about them:
247trademarket.com
abundantthrives.com
affiliatemarketlitepro.com
aicryptocore.net
alpha-primefx.com
apexcoremarkets.net
apexfutureswealth.com
atlasedgeinc.pro
atlasholdinginc.com
atlaxchazebanking.com
aurumtrustbnk.com
bkofheritage.online
blockfinex.ltd
blocks-stream.pro
bluecrestult.com
bnkofheriitage.com
capitalfinanceinvestments.com
capitaltrustybk.com
captgenuisplc.com
cinderfcu.com
citizensbaoox.com
coinmarketcaa.com
coldwalletexpert.com
corecapitals.org
cploot.com
credencecapitaltrustbk.online
cronasset.com
crownmonarchbank.com
denionline.com
denzb.com
deroidpro.com
detrixalerce.org
doubledoorcapital.com
elitewealthholding.ltd
finanvoinvestmentinc.com
fullinvest.pro
gdanskcapitalbk.online
globalpipnations.org
guarantyfbk.com
halalethics.net
imperialtrademarket.com
infinityvaultcapital.com
etc.....
show less
This is ZainHosting in Pakistan - they use vebhost.com as nameservers for the scam domains, they do ...
show moreThis is ZainHosting in Pakistan - they use vebhost.com as nameservers for the scam domains, they do this so people don't know it's Zainhosting that hosts scam sites.
They are hosting a variety of different 419 advanced fee fraud scam sites here such as fake logistics scams, fake investment scams and fake bank scams for example.
apexforgepro.com
bistrust.com
bitfarms-ltd.com
bluestonesntb.online
bncryptoincnet.com
capitalnationalcu.com
eimaewc.com
mtb-int.com
next-traders.com
nostrononlinegroup.com
prime-shares.com
skyiprivateb.com
standard-genesis-ltd.com
uniondevelopmentb.com
vodatrust.online
zentrovacapital.com
show less
This is ZainHosting in Pakistan - they use vebhost.com as nameservers for the scam domains, they do ...
show moreThis is ZainHosting in Pakistan - they use vebhost.com as nameservers for the scam domains, they do this so people don't know it's Zainhosting that hosts scam sites.
They are hosting a variety of different 419 advanced fee fraud scam sites here such as fake logistics scams, fake investment scams and fake bank scams for example.
cedricapital.com
oceansuissecapital.com
qfsledgerquantum.org
semtezminingfx.com
silver-stonefcu.com
stamfordmemberscredit.com
themeramexcooperative.com
trustremittance.com
zimtradesavings.com
show less
So this is vebhost.com - dummy site, used as nameservers for the scam domains - ZainHosting in Pakis ...
show moreSo this is vebhost.com - dummy site, used as nameservers for the scam domains - ZainHosting in Pakistan is the real host - they do this so people don't know it's Zainhosting that hosts 419 advanced fee fraud scam sites.
The IP is already listed on Spamhaus and has an SBL listing:
https://check.spamhaus.org/results?query=154.16.170.58
SBL618921 - 154.16.170.58
2026-02-15 16:19:22 - tier.net
phishing/fraud server
Update 5th February 2025
Problem still exists, phishing all over this place:
This issue has been reported before, but there is still an on-going 419 advanced fee fraud problem on these servers:
alsagx.com
apexindexpro.com
capitaruta.live
elitewavemb.com
fxnexor.com
globalultrasgen.live
incomecreation.org
indexprotraders.org
monexpremium.com
ploxiva.com
premiumglobalonline.com
ssb-groupcorp.com
ssbnk-group.com
unionmarvixservice.com
unique-mining.com
vexatrust.online
show less
Even more scam sites on there:
assetstrustbnk.online
biomexprime.top
bossuemporium.xyz
build ...
show moreEven more scam sites on there:
assetstrustbnk.online
biomexprime.top
bossuemporium.xyz
buildstock-trade.com
coin-marketcapital.biz
greatriverltd.info
horizcaptassetincs.com
megatradespro.com
meritprofits.com
nexasovera.xyz
nuvoryxtradepartners.com
qfsglobal-ledger.com
qfsworldweb3asset.com
securestress.com
standardtrustoffshore.com
sureproofgrowth.com
trustglobalcapital1st.best
universalfinancialacc.icu
zyvotradenetwork.com
This is a fraud facilitating nameserver
The server IP now has an SBL listing on Spamhaus because of them - https://check.spamhaus.org/results?query=37.49.229.75
SBL697934 - 37.49.229.75
2026-06-02 12:55:30 - estoxy.com
Phishing / scam sites
show less
This is being used by Nigerian 419 advanced fee fraud scammers geebytescloud.com
They advertise t ...
show moreThis is being used by Nigerian 419 advanced fee fraud scammers geebytescloud.com
They advertise themselves on social media as a DMCA ignoring web host, what this means in practise is that they allow 419 advanced fee fraud scam sites to be hosted their without the fear of being terminated.
This is hosting the following nameserver:
dns1.geebytesdns.com
dns2.geebytesdns.com
We can see the scam sites here: https://dns.coffee/nameservers/dns1.geebytesdns.com
Using WOWRack IPs: 216.244.65.50 and 216.244.65.54 to host scam sites.
show less
This is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ign ...
show moreThis is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ignores all abuse complaints and help facilitate fraud on MASSIVE scale by hosting scam sites for cybercriminals, botnet C2 servers, malware, phishing, scams, you name it and they will host it no problem, no takedowns, no response on abuse complaints, a veritable hive of scum and villainy.
Here are some of the sites hosted on this IP:
citynatonlbnk.com
dinominestrade.org
fortixcreditunion.com
indextrega.com
nationalbnk.com
paysoul.org
perfect-digital.org
speedsbrave.org
standardencryptedtrade.com
standardwisecreditunion.com
starprocapital.com
texco-fund.com
transitsasset.com
troveexperts.org
unitycrestlimited.com
zylotradedigital.org
show less
This is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ign ...
show moreThis is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ignores all abuse complaints and help facilitate fraud on MASSIVE scale by hosting scam sites for cybercriminals, botnet C2 servers, malware, phishing, scams, you name it and they will host it no problem, no takedowns, no response on abuse complaints, a veritable hive of scum and villainy.
Here are some of the sites hosted on this IP:
axion-access.com
beacon-global-investments.xyz
bkofficial.live
capitalstonebridgemining.com
digitaldexltd.com
equatrust.ltd
infernumglobalreserve.com
luxorachain.com
northspringcapitalbank.com
stockexchangemarketing.com
swiftpaycreditun.com
ultimextradex.live
ultrafintradex.live
velorian-capital.com
wealthholdingsempire.com
wfonline.biz
zodorx.live
show less
This is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ign ...
show moreThis is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ignores all abuse complaints and help facilitate fraud on MASSIVE scale by hosting scam sites for cybercriminals, botnet C2 servers, malware, phishing, scams, you name it and they will host it no problem, no takedowns, no response on abuse complaints, a veritable hive of scum and villainy.
Here are some of the sites hosted on this IP:
afxsignal.top
ascuonlinebanking.com
brisbroker.com
crescenttrustbnk.com
digitalmarketingencompass.com
elitemint.top
finstrisemine.net
grandcoreinvest.com
nextrds.top
okxtrades.net
primefinanceoptions.com
remgroinvt.top
sovereigntrdplatform.click
terrapips.top
teslatreasury.com
trdsolutiontd.top
trdswave.click
show less
This is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ign ...
show moreThis is the bulletproof hosting provider Frantech/BuyVM (The guy behind this is Fransisco Dias), ignores all abuse complaints and help facilitate fraud on MASSIVE scale by hosting scam sites for cybercriminals, botnet C2 servers, malware, phishing, scams, you name it and they will host it no problem, no takedowns, no response on abuse complaints, a veritable hive of scum and villainy.
Here are some of the sites hosted on this IP:
avasignal.top
bestsimplexmarkets.com
bitmaxappglobal.pro
brightgrowths.live
capital-lite.live
citymendmanagements.live
coasterfund.pro
digitaltradechainplc.com
elitewavetradingplatform.com
finurawealthventure.pro
gain-bullish.com
globalfirmelite.pro
gloptions.top
litwave.live
novasignals.top
point72asset-trade.net
puremingx.pro
swiftfund.live
terraeco.top
teslastocks.net
uniquegoals.live
zenithgurus.pro
show less
This is lytehosting.com who are a Nigerian 419 advanced fee fraud facilitating scam hosting company, ...
show moreThis is lytehosting.com who are a Nigerian 419 advanced fee fraud facilitating scam hosting company, who help facilitate fraud for other Nigerian cybercriminals by not shutting down scam sites and allowing them to operate with impunity.
Name Servers:
dns1.lytehosting.com
dns2.lytehosting.com
dns3.lytehosting.com
dns4.lytehosting.com
https://dns.coffee/nameservers/dns1.lytehosting.com
https://dns.coffee/nameservers/dns2.lytehosting.com
https://dns.coffee/nameservers/dns3.lytehosting.com
https://dns.coffee/nameservers/dns4.lytehosting.com
Also using the following IPs to host scam sites:
163.61.188.2 / 163.61.188.5 / 163.61.188.7 / 163.61.188.9 / 163.61.188.105
This is AS153568 NEW DHAKA HARDWARE AS who have multiple SBL listings on Spamaush :
newdhaka.net currently has 6 SBL listings for IPs under its responsibility.
https://check.spamhaus.org/sbl/listings/newdhaka.net/
show less
This is lytehosting.com who are a Nigerian 419 advanced fee fraud facilitating scam hosting company, ...
show moreThis is lytehosting.com who are a Nigerian 419 advanced fee fraud facilitating scam hosting company, who help facilitate fraud for other Nigerian cybercriminals by not shutting down scam sites and allowing them to operate with impunity.
Name Servers:
dns1.lytehosting.com
dns2.lytehosting.com
dns3.lytehosting.com
dns4.lytehosting.com
https://dns.coffee/nameservers/dns1.lytehosting.com
https://dns.coffee/nameservers/dns2.lytehosting.com
https://dns.coffee/nameservers/dns3.lytehosting.com
https://dns.coffee/nameservers/dns4.lytehosting.com
Also using the following IPs to host scam sites:
163.61.188.2 / 163.61.188.5 / 163.61.188.7 / 163.61.188.9 / 163.61.188.105
This is AS153568 NEW DHAKA HARDWARE AS who have multiple SBL listings on Spamaush :
newdhaka.net currently has 6 SBL listings for IPs under its responsibility.
https://check.spamhaus.org/sbl/listings/newdhaka.net/
show less
This IP is being abused by spacemelon.net who are 419 advanced fee fraud scam facilitators that allo ...
show moreThis IP is being abused by spacemelon.net who are 419 advanced fee fraud scam facilitators that allow other Nigerian scammers to host scam sites without being terminated:
Name Servers:
ns1.spacemelon.net
ns2.spacemelon.net
We can see a list of the scam sites on the nameserver: https://dns.coffee/nameservers/ns1.spacemelon.net
Here are just some of the scam sites that they are hosting on this IP, these sites are also flagged as malicious by Netcraft
aknanwmb[.]win | fake bank scam
apexglobalstoc[.]com | fake investment scam
bluepillarcu[.]online | fake bank scam
capitalassetscu[.]com | fake investment scam
capitalsetscru[.]com | fake investment scam
celeritys[.]ink | fake investment scam
eicbl[.]com | fake bank scam
fastlanedeliveryco[.]com| fake logistics scam
globalstockspro[.]com | fake investment scam
globalstockst[.]com | fake investment scam
globalstocksvest[.]com | fake investment scam
primecapit[.]sbs | fake investment scam
swiftreliancegrp[.]org | fake bank scam
show less
This IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host tha ...
show moreThis IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host that hosts scam sites for Nigerian fraudsters.
They use the following IPs:
86.107.77.91
86.107.77.95
86.107.77.98
86.107.77.108
86.107.77.112
86.107.77.119
86.107.77.213
We can see a list of the scam sites hosted here: https://dns.coffee/nameservers/dns1.tela-host.com
We can see some of the fake investment scam sites here:
alphaequity.ltd
extremassets.com
1world-cryp2.us
amtefis.pro
bridgewayshares.com
m36digital.com
forexoption.info
goldpocketoption.com
finance-markex.info
pocketoptionsinvestmentcompany.info
monumentaccess.com
hostbet.in have a history of allowing these scam hosts to use their servers and ignoring all abuse reports.
show less
This IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host tha ...
show moreThis IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host that hosts scam sites for Nigerian fraudsters.
They use the following IPs:
86.107.77.91
86.107.77.95
86.107.77.98
86.107.77.108
86.107.77.112
86.107.77.119
86.107.77.213
We can see a list of the scam sites hosted here: https://dns.coffee/nameservers/dns1.tela-host.com
We can see some of the fake investment scam sites here:
alphaequity.ltd
extremassets.com
1world-cryp2.us
amtefis.pro
bridgewayshares.com
m36digital.com
forexoption.info
goldpocketoption.com
finance-markex.info
pocketoptionsinvestmentcompany.info
monumentaccess.com
hostbet.in have a history of allowing these scam hosts to use their servers and ignoring all abuse reports.
show less
This IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host tha ...
show moreThis IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host that hosts scam sites for Nigerian fraudsters.
They use the following IPs:
86.107.77.91
86.107.77.95
86.107.77.98
86.107.77.108
86.107.77.112
86.107.77.119
86.107.77.213
We can see a list of the scam sites hosted here: https://dns.coffee/nameservers/dns1.tela-host.com
We can see some of the fake investment scam sites here:
alphaequity.ltd
extremassets.com
1world-cryp2.us
amtefis.pro
bridgewayshares.com
m36digital.com
forexoption.info
goldpocketoption.com
finance-markex.info
pocketoptionsinvestmentcompany.info
monumentaccess.com
hostbet.in have a history of allowing these scam hosts to use their servers and ignoring all abuse reports.
show less
This IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host tha ...
show moreThis IP is being used by telahosting.com who are a 419 advanced fee fraud scam facilitating host that hosts scam sites for Nigerian fraudsters.
They use the following IPs:
86.107.77.91
86.107.77.95
86.107.77.98
86.107.77.108
86.107.77.112
86.107.77.119
86.107.77.213
We can see a list of the scam sites hosted here: https://dns.coffee/nameservers/dns1.tela-host.com
We can see some of the fake investment scam sites here:
alphaequity.ltd
extremassets.com
1world-cryp2.us
amtefis.pro
bridgewayshares.com
m36digital.com
forexoption.info
goldpocketoption.com
finance-markex.info
pocketoptionsinvestmentcompany.info
monumentaccess.com
hostbet.in have a history of allowing these scam hosts to use their servers and ignoring all abuse reports.
show less
Phishing
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.